Louisiana healthcare breach data

Notification deadline

In the most expedient time possible and without unreasonable delay but not later than 60 days from the discovery of the breach, consistent with (i) the legitimate needs of law enforcement as provided in § 51:3074(F), and (ii) any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system. When notification is delayed pursuant to § 51:3074(F) or for scope-determination / prevention-of-further-disclosure / data-system-restoration reasons, the person or agency must provide the Louisiana Attorney General written reasons for the delay WITHIN the 60-day notification period; upon receipt, the AG allows a reasonable extension.

State regulator notice

Required

The Louisiana Attorney General must be notified whenever Louisiana-resident notice is required under § 51:3074. There is no numeric threshold — the AG notice is triggered by any breach requiring individual notice. Under LAC 16:III.701(B) (rules promulgated by the Louisiana AG pursuant to § 51:3077's rulemaking directive), the AG notice must include the names of all Louisiana citizens affected by the breach.